Mach/Inject.cpp

   1 /* Cycript - Inlining/Optimizing JavaScript Compiler
   2  * Copyright (C) 2009  Jay Freeman (saurik)
   3 */
   4
   5 /* Modified BSD License {{{ */
   6 /*
   7  *        Redistribution and use in source and binary
   8  * forms, with or without modification, are permitted
   9  * provided that the following conditions are met:
  10  *
  11  * 1. Redistributions of source code must retain the
  12  *    above copyright notice, this list of conditions
  13  *    and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the
  15  *    above copyright notice, this list of conditions
  16  *    and the following disclaimer in the documentation
  17  *    and/or other materials provided with the
  18  *    distribution.
  19  * 3. The name of the author may not be used to endorse
  20  *    or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS''
  24  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
  25  * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  26  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
  28  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  29  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  30  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  31  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  33  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
  34  * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  35  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  36  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  37 */
  38 /* }}} */
  39
  40 #include <dlfcn.h>
  41 #include <mach/mach.h>
  42
  43 extern "C" {
  44 #include <mach-o/nlist.h>
  45 }
  46
  47 #include <cstdio>
  48 #include <pthread.h>
  49 #include <unistd.h>
  50
  51 #include "Baton.hpp"
  52 #include "Exception.hpp"
  53 #include "Pooling.hpp"
  54 #include "Trampoline.t.hpp"
  55
  56 extern "C" void __pthread_set_self(pthread_t);
  57
  58 template <typename Type_>
  59 static void nlset(Type_ &function, struct nlist *nl, size_t index) {
  60     struct nlist &name(nl[index]);
  61     uintptr_t value(name.n_value);
  62     _assert(value != 0);
  63     if ((name.n_desc & N_ARM_THUMB_DEF) != 0)
  64         value |= 0x00000001;
  65     function = value;
  66 }
  67
  68 void InjectLibrary(pid_t pid) {
  69     // XXX: break this into the build environment
  70     const char *library("/usr/lib/libcycript.dylib");
  71
  72     static const size_t Stack_(8 * 1024);
  73     size_t length(strlen(library) + 1), depth(sizeof(Baton) + length);
  74     depth = (depth + sizeof(uintptr_t) + 1) / sizeof(uintptr_t) * sizeof(uintptr_t);
  75
  76     CYPool pool;
  77     uint8_t *local(reinterpret_cast<uint8_t *>(apr_palloc(pool, depth)));
  78     Baton *baton(reinterpret_cast<Baton *>(local));
  79
  80     uintptr_t set_self_internal;
  81     uintptr_t set_self_external;
  82
  83 #if defined(__i386__) || defined(__arm__)
  84     struct nlist nl[3];
  85     memset(nl, 0, sizeof(nl));
  86     nl[0].n_un.n_name = (char *) "__pthread_set_self";
  87     nl[1].n_un.n_name = (char *) "___pthread_set_self";
  88     nlist("/usr/lib/libSystem.B.dylib", nl);
  89     nlset(set_self_internal, nl, 0);
  90     nlset(set_self_external, nl, 1);
  91 #else
  92     set_self_internal = 0;
  93     set_self_external = 0;
  94 #endif
  95
  96     baton->_pthread_set_self = reinterpret_cast<void (*)(pthread_t)>(reinterpret_cast<uintptr_t>(&__pthread_set_self) - set_self_external + set_self_internal);
  97
  98     baton->pthread_create = &pthread_create;
  99     baton->pthread_join = &pthread_join;
 100
 101     baton->dlopen = &dlopen;
 102     baton->dlsym = &dlsym;
 103
 104     baton->mach_thread_self = &mach_thread_self;
 105     baton->thread_terminate = &thread_terminate;
 106
 107     baton->pid = getpid();
 108     memcpy(baton->library, library, length);
 109
 110     vm_size_t size(depth + Stack_);
 111
 112     mach_port_t self(mach_task_self()), task;
 113     _krncall(task_for_pid(self, pid, &task));
 114
 115     vm_address_t stack;
 116     _krncall(vm_allocate(task, &stack, size, true));
 117     vm_address_t data(stack + Stack_);
 118
 119     vm_write(task, data, reinterpret_cast<vm_address_t>(baton), depth);
 120
 121     vm_address_t code;
 122     _krncall(vm_allocate(task, &code, sizeof(Trampoline_), true));
 123     vm_write(task, code, reinterpret_cast<vm_address_t>(Trampoline_), sizeof(Trampoline_));
 124     _krncall(vm_protect(task, code, sizeof(Trampoline_), false, VM_PROT_READ | VM_PROT_EXECUTE));
 125
 126     thread_act_t thread;
 127     _krncall(thread_create(task, &thread));
 128
 129     thread_state_flavor_t flavor;
 130     mach_msg_type_number_t count;
 131     size_t push;
 132
 133 #if defined(__arm__)
 134     arm_thread_state_t state;
 135     flavor = ARM_THREAD_STATE;
 136     count = ARM_THREAD_STATE_COUNT;
 137     push = 0;
 138 #elif defined(__i386__) || defined(__x86_64__)
 139     i386_thread_state_t state;
 140     flavor = i386_THREAD_STATE;
 141     count = i386_THREAD_STATE_COUNT;
 142     push = 5;
 143 #else
 144     #error XXX: implement
 145 #endif
 146
 147     uintptr_t frame[push];
 148     if (sizeof(frame) != 0)
 149         memset(frame, 0, sizeof(frame));
 150
 151     memset(&state, 0, sizeof(state));
 152
 153     mach_msg_type_number_t read(count);
 154     _krncall(thread_get_state(thread, flavor, reinterpret_cast<thread_state_t>(&state), &read));
 155     _assert(count == count);
 156
 157 #if defined(__arm__)
 158     state.r[0] = data;
 159     state.sp = stack + Stack_;
 160     state.pc = code;
 161
 162     if ((state.pc & 0x1) != 0) {
 163         state.pc &= ~0x1;
 164         state.cpsr |= 0x20;
 165     }
 166 #elif defined(__i386__) || defined(__x86_64__)
 167     frame[0] = 0;
 168     frame[1] = data;
 169
 170     state.__eip = code;
 171     state.__esp = stack + Stack_ - sizeof(frame);
 172 #else
 173     #error XXX: implement
 174 #endif
 175
 176     if (sizeof(frame) != 0)
 177         vm_write(task, stack + Stack_ - sizeof(frame), reinterpret_cast<vm_address_t>(frame), sizeof(frame));
 178
 179     _krncall(thread_set_state(thread, flavor, reinterpret_cast<thread_state_t>(&state), count));
 180     _krncall(thread_resume(thread));
 181
 182     _krncall(mach_port_deallocate(self, task));
 183 }